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(54) Method and apparatus for free previews of 

(57) Limited duration previews of program offerings 
availablfi.for purchase via a communication network are 
provided in .a^rypbgrap^^ secure manner at virtu- 
ally any-time during- the^seryice. The invention has par 1 - : 
ticular applicability to the provision of video services on 
a pay-per-view basis. Such a video service is provided 
during a program epoch (PE). A fixed period (72-74) is 
defined during the program epoch (72-78) when portions 
of the: video service are available tor viewing on a preview 



communication network f^vtee^, j v [ 

basis. A consumer is allow€cTto T ^e\>ie^i without pur- 
chase, portions of the videb slrUce dt any time during 
the, fixed period Jor, up to a, maximum ptffyiew duration 
' (82)^^Shoi^^^.|(^|}4i^(^74). Thecon- 
sumer canihen j^rchase Jljie y#eoJ .service for viewing 
during the program epoch (72-78) after prieviewing 1 por- 
tions thereof. A plurality of records (90. 92^94, 96, 98) is 
maintained to service different previewable programs 
concurrently. 
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Description 



SUMMARY OF THE INVENTION 



BACKGROUND OF THE INVENTION ooo^s- 

The present Invention delates to cortimuftcifi^rfe' 
networks ? such as cable felevisionf satellite tel eviSoh and 
computer networks over which servides'are available for " 
a fee, arid<mdre particularly to a method 1 and apparatus 
for providing free previews of individual program offer- ^' 
ings (e.g^a movie)prior to purchasing that offering? ~ to 

Cable and satellite television networks where video 
services are available for a tea are welt "known. Also well : ' 
known are computer network s£rvitfes : such' as <>om-- ■ 
puServe, Pradigy, America Online, Dialog i Iriforrhation 
Service/ ahd others where" databases; banking 'and is 
shopping services can-be accessed ^ e-maii aritf the* * : . 
like can be'commuriicated; all for a feeV In the past, some " 
communication networks hav^'prcvided services on a- ■ 14 ' 
free trial basis For example, pay per view televisidnfhov 1 
ies, in which a viewer can order a'rhovi£ for viewing Fupoh^ 20 
payment Of a fee, have~ sorhetimesVhabled Viewers-to- 
watch the first five minutes or so of the movfe brVapre- : v 
view basis before purchase is required. Such previews 
were limited to a" predefined tirri^-|ter"^ 
of the movie. Free previews were not available at any 25 
other time during the broadcast of the 1 mdvie. : 

The provision of a limited fre4 preview at "any time 
during the broadca^ -df'a servicje (such as a- movie) 
would be-destrable"fr6m a consumer's sfandpoint?^dr 
video services, a viewer would notbeconstrain^Totfav* 30 
ing a pfeview briiy ai the beginning of the program, whscfi 
may not be a convenient tirriefor the viewer. However, 
the provision of a limited duration free preview at anytime 
during the availability of a service is f raught with danger 
from the standpoint of the service provider In partidilaK 35 
opening up *a service to free-previews at^ariy time : may 
make it possible for an unscrupulous viewer or "pirate" 
to defeat the security of the signal and bbtain%fe : entir& 
service without charge. :i ar * c - > 1 " yiCi * ' v 

It would be advantageous to ^fovide a method artel 40 
apparatus for allowing a lifri^ 
virtually any timesharing the provisioiv of 5 & ; &rvice: j: it 
would be further advantageous to prbviQels^h a rne^^ 
and ^paratiisthat ar§hot Easily ta^n adv^tag^ o^b^ 
unscrupulous customers or pirates. Such a method and 45 
apparatus should rtiaintein signal -s^rity^iJe^ovid^^'- 
ing the flexbility of an "anytime free preview" (AFP). It 
would also be advantageous to provide such a rrtetridd 
and apparatus that enablea viewer to ^ch : tedc'a'ritf : 
forth between one or more AFPs (each aWoaatefci with- : so 
a differert service) and conventional programming :'EacK u 
AFP would be limited to its own j^rticular'm^imum AFP * 
duration. Siich a system must remain secure at ail tirrie$ r " 1 
and prevent a viewer from obtaining free previews fbr - 
more than the maximum duration assigned to the partic- 55 
ular service? The present invention prov1cles : a : method 
and apparatus having the aforementiortei arid bttieP- 
advantages. x * ! 



A method in accordance with the present invention 
provides video services to consumers via an irrformatiph 
Network. A video service is provided on a pay-per-view r "" 
basis during a program epoch. A fixed iteVipd is defined ^ 
during the prograrh' epoch when portion^ ^ the video : ^ 
service are available for viewing on a preview basis: A ~ * 
consumer is allowed to preview, without purchase, po£ ''~ ' 
tions of the video service at any time during the fix&j 
peridd for up to"a maximum preview duration tfet s r 
shorter than the fixed period. The rfaximum prevt£w v: 
duratiorr is preferably enforced in a'cryptbgraphlcall/ r ' 
secure manner- In particular, a record dan be maintained ; 
in a cryptographicatfy sefcure 'manner to indicate tfte 
amount 6f unused preview time remaining for tfiVBori- K ' £ 
sumer to view the video service during the fixed pWTod?' : ~ 
The fixed period during which portions of the vicieo serv- ? 
ice are'available for previewing, as well as data 16 eh^- 
ing whether a preview is available for a particufaVserviciB, 0 ~ : 
are also preferably maintained in a crypt^aphically %v c> 
secure manner. - ■* , . , * r ..-r.ot 

in a preferred embodiment, the method of the iniv§n- :i 
tion Enables a consumer to purchase the video service G 
for viewing during the program epbch after previewing - 7V 
portibnsof the service. Also in the preferred OTbddi- 
ment, the program epoch is divided into a plurality' of ti= 
working key epochs (WKE's) A count of the WKE's is ' ?>p 
ayptographically authenticated. The authenticated 1 1 
dount is used to implerheht (i.e., define and keep tradk ' 
of) said maxirhum preview duration. - : ; - - r - : : J 

The method can further comprise the steps of main- ' " 
taining a record of services which the cbnsumer has pre- " 
viewed during |Drior program epocfis. The 'consumer is ' 
then prohibited from previewing a service during a cur- : 
rent program epoch if the consumer has previewed any r a 
part of that service during a prior program epoch. This 
prev^its V S cbnsumer from recording^ successive free ~ 
previews in order to accumulate a full movie or other prb- ^ 
gram for viewing. The record of services wtiich the con- ^ 
sumer has previewed during prior program 'Epochs caH * ; 
be maintaineci'h a cryptogfapKicaiiy sSciire marihlr c ' 

In^an illOstratkientDodimerrt, up to'N atiwer^ftii r:UH 
of prew^iewable 'services-can be ^ rrointafned W^%me\ v ~ *' 
Each record comprises either a purchase reco'rcl repfe- ' ' 
senting a previewabie service that has beenpurchased c '' 
by the consumer or a preview record representing a serv- 
ice that the cbnsumer has selected for preview The dxpi- ! 
ration ' of in active previewabie service record is ' 
prevented ufrtil the program epoch for thfe service' r^re- : u 
sentdcl by that record is over. The ©cpiration tirfie is 'coh- 
trolled by ah Expiration timer. Alternatively, the expiratibrl 
can be prevented by establishing a fixed minimum tirhe S: 
period (e.g.; several hours) for each record. The fixed' 
minimum record duration is longer than the lonigfest serv- : 
ice that has a free preview availabie: - *- ' 

The method of the present invention can also " 
include the step of preventing the erasure of any preview 
record until the program epoch' for the service r^are- 
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serrted thereby is over, in the illustrated embodiment, a 
preview record is converted to a purchase record upon 
purchase by the consumer of the service represented by 
the preview record. At the time of conversion, the pur- . 
chase/ecord is rendered irrevocable. In such an embpd- , .5. 
iment, the erasure of any preview record is prevented / 
until .the program epoch for. the service represented 
thereby is over, except that a preview record can be '. 
erased by conversion to an irrevocable purchase record. 

Whenever all N records of previewable services are 10 
activ^, additional previews are denied to the consurner. - ? 
However,, a consumer can still purchase a, service, in „ y 
which; event one of the preview, records- will be overwrit- , r 
ten witlp, a purchase record. Preferably, .the next to expire w 
preview record will be the one tfratjs overwritten, yvhen is 
a preview rjepord is open, the consumer can be informed 
of how njyph unused preview time remains for the corre- . 
sponcjipg V&jfjP service. 

App^jitus jp accordance with the present invjentipn^ ^ 
provides previews of services available for purchase via 20 
a comm^icaiipn network First means process data . ;3 
received from the communication network. The data (i) 
iderrt^ies.a.servic^ javaijable for purchase t 00 identifies 
a per ) i^ ^.tirr^ .(epoch) pver which the service is pro- 
vided, (iiQLirjdicates whether a preview is available for, the .25 
service v and (u) provides information necessary to gen-,, 
erate/keys. for '.enablirjg an- authorized consumer to 
recejve tfcje service pr^ prev|ew thereof ^Second means,, K 
responsive to the first means.whep,a preview, is available jV , 
for the service, are provided for keeping track of a fixefd. 30 
period during the epoch when previewing is permitted. 
A user Jnt^rfgceL cooperates with, the first and secpnd 
means '.far. ^enabling a-qpnsumer tg preview portions of 
the service, at any. time during the fixed period for up to 
a maximumprp/iewdu rati on ^hatjs shorter than the fixed 35 
period. Th§ user, interface also enables a consumer to 
purchase ,tjbe service..A/leans are responsive tct the first 
means for deci^tir^.the seryiqe during a preview and 
after'^purqriase therepf.", . - . 

T^ie apparatus ip apcprdance, with the invention cpn 40 
furthe^i^^ maxjmum pre- r , 

viewdura^pn 

app^^clq'^intain a record ip acryptographically 
secure jT^r^r'tp ipdicate the amount of unused preview , 
time rerrair\if)g for the.opnsumer to view. the service dur- )ft 45 
ing^efjxjed.pefipd^ f . /\ - 

Means . cap be provided for maintaining up to N 
active secprds^of prWiewaWe seryices at a time. Each 
record '<^mpy:isa5 either a purcjhase record representing 
a priyjewable service that has been purchased by tt>e so 
a)n^m^ ctfapr r ^iwrecc^ repr^errtjrig a service that 
the consumer has seized, fpr preview. Means arepro : 
vided Jpr prWeoftng the expiration of an active preview- . 
able' servicei record until the prograrn eppch for the 
servipe. presented by that record is over. Means can 55 
further be provided for preventing the erasure of any pre? 
view, repord. until the prpgram epoch, for. the service rep- 
resented thereby is over. In an Illustrated embodiment, 
means are provided for converting a preview record to a 



purchase record upon purchase by the consumer of the . . 
service represented by the preview record. The pur- 
chase record provided, by the converting means is renr 
dered irrevocable. Except for possible conversion to an 
irrevocable* purchase record„the erasurapf any, preview 
record ^prey^nted until the program, eppch for the^erv- . 
ice r^r^nted thereby js.over. i; . . 

Th% apparatus ot the invention can f urthercomprise 
meansfor denying any previews orpreviewable services . :". 
to the consumer- whenever ajl- N previewabje service . 
reco^j^re ^(^^ ^63,05 can also be provided^for, 
informiqgytfre qppsumer^of hqw much ur\u$ed preview *v 
time Ferjirain^fcrt' each service^; ^ . , : ..■ . ... . 

In an illustrated errtxxjirpept,-.the ,epoch over which, t 
the service is provided is dry id.ed into a pi urelity of .worts-; .~ ~ 
ing key epochs. A crypritpgraphicaty cpunt 
of the working key epochs & used to inplementirsaid* 
maxim^preyiew duratjqn. Me§ns~are provide^ foii fuf- - 
ther cryptographjcally authenticating at least the portion; ... 
of the, d^a,,th£t identifies whether ji preview is available 
for sajcfe^yjpe, andthe f jxcjd perjixl- during c whjch pre- h 
viewi^g^ permitted. ,. r ,j ; . .:. ; : t ' . r 1 1 :n\ « 

BRIEF DESCBIPTIpN ORTHE DRAWiMGS 

Figure 1 is aii>lpck.diagi^ra^j^paratus in accprd- - 
anpe wrfrirtfie pr^se^kiyerition;; s ; ; c 3 j VO x * '.IV 
rTigvr^2Jsa^ t ^diasr -3 
hjeraFc(}y jn+ apmiganpe- with . ftie^ pgesent; 

i | W € ^#H!^^v' # .: '. J .on o .cwt.^i s cSC.r/ <e3 o^U'v 
ffigurp a is a-time line, i U t^trii^d «c*rtf^i?esni pr^g^m^ 
^p(^,h§ thalpcqgr^pver timQ; u t r ^i ^tco 6 4 &r r 
Bgjyre 4^is ^diagrammaflo : iUi^tr^tiqrj ,of OQ$;pro*t- . 
qfgm^epp^i, il(i^atiQg;y^iqu& : l^un^ 
t^p^d ^ierein^§^d ^ sample 5 of the, wprWrig «^ey . - 
epflcl^^^^^^sj^that occur, during the program; 

|ngvur ; er&fes a.dia^rai^TT»t^Ulustra^Drn of various pre- - 
view/program records ^tihat are rmir^in^rxaccprd- 
, ^%^^%ii3ye^qn^ ?lx ^./r ^o^ . 
^9WSf?^ tfetiffi e^fl? ft^Qtert ijk^r^r^ th% ^ :i - t 

^ur^j^ogntinua^pn^^ 

petailIp p^fflSwoiri -miiNvgw-noN , , 

^gure 1 ilig^r§te^ in t block diagram form, ttie 
deci^^QP portion of a digital satellite or cable television 

-receiver c^t^i*^ -%vencrypted seryic^^e.g., ^.pre 

miurji ^television -service), is, input to terminal [10.. c By the * , 
time the twtetrearr> comprising th^ seryiqe ip input to ter- ■ , 
minai ip f it has §!re^ly bjien. received and demodulated . 
from^thf oomr^^ oyer wtyph it is trans: 

.mitted, using conyertior^^echnigues. The encrypted 
service is d^crypied by a decryption processor 1.2 in . 
order^to provide a^lear signal at output 1 6 of the decryp- - t 
tion processor. - 
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The decryption processor can utilize a conventional - - 
decryption scheme, such as that disclosed irvGilhoCisen, ; 
etal. U.S. patent 4,613,901 entitled "Signal Encryption 
and Distribution System for Controlling Scrambling and .s - 
Selective Remote Descramblrng of Television Signals*? - s 
or Bennett et al. U.S. patent 4.864,615 entities -Repro^* : 
duction of .Secure Keys By Using Distributed Key~Gen- ' r 
eration Data, n ~both .incorporated- herein by reference./ 
The decryption processor requires working keys (WK) if* - - 
order to decrypt the signals input thereto via terminal *0: t . 1& 
The working keys arje, generated by a secjjre processor- 
20 in response to control signals received via igputfoutv r 
put (l/QX terrriinal 30; firmware for the secure, processor - 3 
is stored in read only, memory XROM): 24.fThe^secure; ? » > 
processor is also provided* with random accessimempry ^ 75 
(RAM) 22 in a conventional manner. lA s^ureportiQa-of 
RAM. 22 holds unit specif ic^kexSiBTKyc^ s^^^or tuce in- 
decryption of a monthly ^key^ as> discussed >,in greater *o 
detailjn connection with Figure 2. ~ ;r v . ; . 

A user interface 26 enables^! vieweF to^eiect ; serv^ ~. 20 
ices for viewing on a television (TV) 28. KauserisatitKdr> 
ized to receive the selected .service by subscription^ 
individual purchase,<e:g. ,:pay per view), secure » proems* * --Vi 
sor 20 will actuate switch TSto couple the decrypted but-'" ^ 
put 16 from decryption processor 12 to the TV 28 via W 
user interface 26. Otherwise; the 5 useriinterface and^TV ^ - 
will only receive. the encrypted signal via line^ 14 f n - 

Switch '18^< ^ .0 K-.C . ' ;->.-,; ..s.if.v .-C ( j 

A typical key hierarchy is illustrated in Figure^Arf r * 
encrypted programprerkey isinput via terminal 4G*6fe* 30- 
decryption Junction^ which also receivers a monthly key 
via terminal) 42.rThe program pre-keyJs unique to eadh 
encrypted programs offering (e;g. , television program} 
that is ^av^ilable-for decryption^ The- > monthly-key^ is 
changed on aperiodic basis/e.g., once each mbnth. The 35 
decryption function 44 decrypts the encrypt^ program 
pre-key to provide a program pre-key that is US&d as one" 
input to a one-way function 48. The-other input: tb^ond 
way function 48 comprises various 'program attnbtSte&r ' 
including access: requirements- ^for *e"6drrespbridirig 40< 
program? The acces&requir^ehts^mus^ 
to obtainauthorizationto viewOe prt^^.^e^to&^' r ;- ' 
attributes are input via ter minal 40; f ar^^e«oft e wayf url^- 1 - r - 
tion processes the / program pr&-key* arid « program- * * r " 
attributes to provide a program key>Thepmgram key but- = v 4& 
put from one way- function 48 is used as brie input tb>- 
another one way functions that also receives, via't®'-^ 
minal 50, an initialization vector {\V)> representative of ,i 
time. The processing of the initialization vector arid pro^ c 
gram key by one way function 52 generates the wofking so 
keys required-by decryption'prbcessor 12 (Figure -1) t& - 
decrypt the service seized by an authorized user. Af Ur- I * 
ther description of the generation of the* various keys, 11 ^ 
including .working keys (provid^1na"keystreanr7, can 
be found in the aforementioned Bennett, et al. patent; -'ss 

Figure 3 is adiagrammatic illustration of the^initiali- 
zationivectorthat is input to terminal SOofoneway tunc- * ^ 
tion 52. -The; initialization vector 60 commences at ? 
time I and runs until time = J , which cahbe, for etfanv * 



pie, several weeksrat which time the count resets. During 
the time represented by the vector 60, a plurality of pro- 
gram epochs (PEi through PE n ) occur. Each program 
epoch can be of a different length, and is associated with ' : 
one program* offering. * " v * . : r . .-.ro 

Figure' 4 is a diagrammatic illustration ^ one pro- 
gram epoch, generally designated 70. The epoch; Starts ' 
at timV72 and ends at time 78. Prior to the erKl eff the 
epoch, there is aft AFP boundary 74 and a program ^ • 
boundary 76. The time between the start of the- epoch 
72 and the AFP boundary 74 is a fixed period during ihe* 
Program epoch whervportibns of the program are avail- ' C; 
able for viewing on a preview basis. During this fixed 2 
period, the program can be previewed for a maximum ?srJ 
AFP duration 82. As indicated by arrows 84 grid 86'1n : v ' u ' 
Figure 4, the AFP can be viewed'at arty time from i the ' s 
start of the epoch to the AFP boundary'buf only for u£~ ^ 
to the maximum AFP duration T* provided. } ln order tb v " : ^ 
permit a viewer to view some part of the altawe&Pfrefe v ; * 
preview time, tone away, and then return to watcH the ! i; v - j 
remaining part, the maximum AFP duration 82 is main- ? ' : = 
tained as count of working keys which-is decremented 5 :r:J 
as the allowable AFP time is fused up. V 3. r .0 

During a program' epoch, working keys are $eher- >: - 
ated for authorized subscribiers that have purchased or;' 
during a preview period; requested a preview of the pro- 
gram. >The' ? program epoch is divided into a plurality^ of - 
working key epochs (VVKE's) 80. as iliustrated in Figure ' • 
4. For example, the working key epochs may obctif ata " " 
riate of eight WKE's per second/or-at any other 1 interval 3 
that is desirable for a given implementation of tfie sys^ : 
tern. The WKE's can provided convenient means fbr rv ' 
maintaihihg the integrity of the AFP boundary 74. fri ^a J c: 
preferred embodiment, the'AFP boundary is the value d 1 f r 
the WKE repr^eriting the boundary beyond which ah v 
anytime free preview is not allbwedi This parameter Is 9 ;7 
authentibated by including it in the program key genera- : 
tors. The computation and rrtaintehance' of the AFP " 
boundary is disciiissed iri greater detail below, iheorinee^ * ' ' 
tion with Figures 6 and 7. ? 

The program bouhdary 76 7 is the^poirft : atwhich%e 
program providea-durihg the"^x>ch ts expected to 1 erKf. ,;: n 
The end of the epodi 78 may extend 

boundary 76 to acx^rrimodate the jx^ibility'Sf 'a 'pfo-^' :C 
gram running over its origiriaf expected length. For exam-; "* v 
pie, if a program is irrterriipted by : a news bulletin, tHer ' 
program' ending time may be extended. Simllarlyf si nee 5 : f 
it is impossible'tb accurately predict the end of a sporW 
event, it may be necessary to extend the program bound-" 1 
ary within^ the* program epoch to ac^rrirhodate a game * 
that runs into overtime; ' j ^ j 

In accordance with' the present 1 invehtibn, ntffree ^ 
previews are permitted after the AFP boundary 74; Thtis, ' 
during the portion of a program thatruns betWeeh the" J 
AFP boundary 74 and the epoch iend 78. free previews : 
can not be obtained. The 1 reason for providing the AFP' 
boundary is to defend against certain attacks by a pirate : 
who attenpts to use the AFP feature in order to obtain a 
program or service without proper payment. In particular; 
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a pirate may-attempt to change the timeat which a pror ■ . >. 
gram epoch ends in order to obtain free services. How- 1 - - 
ever.this w^H not help him steal successive anytime free - , 
previews, jD^use th? AFP boundary is an : autherrti- c- 
cated value beyond which free previews will not be avail-; .. 6 - 
able. Further, as ..explained in greater detail below r) the 
presfbl'irjventibn establishes "records" of previews,arid r 
purc|aped programs, .which are ir not allowed jto. expire ~ ■ 
prer^atucelyJri a way that would be helpful f to f a pirate. < : 

Uv.p^errto preventJhe theftof, servjcesbylakipg 
advarrtagjB: qf the anytime free preview - feature^ the 
secui:e^r:c£j^sor 20 (Figure 1) of Ihespresent invention ? j 
secucflyiregulatesTthe durational aprograrn segment tu 
that may; be yjewe& without purchase„Jn order to accom- 
plish ,thi£, 4he anytime free preview, duration is main- 75, 
tain^ jin v unit^ ; jgf working key epochs. ^The secure 
proce$spr f counts the number x>l free working keys ;s 
gen^tfd..W^erv^e v cx>unt reachesa lincvt established /, : 
by tl^^i»^jn?um A£: p duration ^(Figure 4), the.-awthpr-f -sr. 
izatipp ^state i^ .changed frprp "can buy or obtain a free; ^20 
previe\f£\to "can,t>uy orj]y4VThe AFP duration is oi^e of . si 
the program attributes that is included in the generation - 
of the'program key. Thus. r & can not be: altered without 
altering, the program key itself, which would prevent the 
correct decrvptipn of the ; program. - * •* 25 

A^ t> rnerption^l above, the system of. the present , 
inven^ofi j( estabijslj^ a/ecprd.iorreach prpgra^n pre- 
viewed^r-purch^ecj. Once the usei; cl?oose%to vi§w fhi* 
AFP, a^eview record" iscreated in the secure proces- . \ 
sor 2p v to define the pum^efof free working keys allowed, 30 
and tp.,ke_ep a realtime, counter to cause, the record to •* 
expire whi ttle eventor .progrann js over. The tiiper must - - .* 
continue to run whether of not the receiver is syncjiror ^ - i.- 
nized^to t ,a,,scrambled or encrypt^ jwavefprm, so that 
records t expir.e at the proper time, if an AFP record were, 35 
to e^irf earjy, second v fre^ viewing period coulcj be , 
taken^lf'li^ reoord expires la*e, no harm is dongJxrt the ,^.3 
numbe^'of jjew free ptevjew.pfferings is reduced during 
the exi^epce^pf Jhe ,record tieypnd .the encl^of ttie pro- 
gram/" . ";■•«? .... * t 40 

(j^ accordance-.jwith the present-invention, upjto N 
multiiun^ EaGh^recoiil^s 
eithec^ ^^^^j^jr^pind" jr^cosontirig^an ^nytimefree 
previe^.sil^^^y^^user, a "purchase recprd-repre- : « C o 
sentij^£pr<^a^^ ^4$ 
(null^cecord^ Alsp, "it} accordance yith thejDre^nt inven- 
tion, it is , not possible for & preyiew record for a given ? 
event t tp be erased before the event is over, except Py a 
legitimatepucph^seof toe event or another purchasable ::r , 
service, ip whidrcase the record is oyerwrfttento provide../ so 
a purchase record, typically, a user will request a free , 
preview, and thep-decide whether of not to purchase the 
event base£ on the free preview. If the event is no£ pur-.. v 
chased, the w preview record is ircaiptainied unti' the end of : . ^ 
the event unless another .service is purchased fc> over- ^ss 
write>. if the user decides to purchase theevent, then , z 
the preview record is converted to a purchase record. .. L 

Preventing the erasure of a preview record before 
the event is over is an essential feature of the present " - 



invention:' If preview records were merely stored in a? irst- 
in firstTOUtiCttfeue (FIFO), older records would be lost as 4 
new recofdaafe added. rA user could then cumulatively 
watch, tnorerihan the free preview limit by scanning 
through and "watching one second^of a number of pro- : 
grams, tq&llu3fe the queue; and then returns to watch " . 
anotheofteepreview of,thfe desired program. This oppor- 
tunity jstproc&ided by.the maintenance tot each preview : 
record fib the <entme . event X)nce5the preview record 4s 1 
establjsh%d:rrr^; "frit « >3 ^ t. sX -.. ■* ;v. 

Ai»wvaccPrdanGe ^ with'^hg'inveraidh, phbgram puV- 
ctiasefst^^|^ecedence"overfr§fe"pre(viwbff^^ 1 
a case where all N available prevjeW/pur<Jh&s^! rebb^ds : 
are acti«^oaftd^at : least^ one r«3ord« holds Sh^AFP.^the 
secure<processor20 wllNnidicalfe the authorization state * : » 
as "c^n buy." The reas6n<tor this isthat even though all 
of the available pis^vie^^rch^ in use,* one " l • 

of the Active previtw^records caft be replaced by a pur- 
chase record. Preferably, ihe- prevfeW rfecofd' that is 1 ; ■ 
replacftcJ by: the purchase recordrwill be the one that is 
doseatrtQi.expiNe)g.< 1 \ h ~ ' &a- j^: 

rt<jBfCj$Q important toccarefuljy conteoh any opportu^ * 
nity fo^fijuser to erase a preview r^cortk since the ability 
to erasie^^such^Tecordpi^ides arfiDpportunity for abuse. 

F : gr exarrpie;'a pnogmm that js^purchas^d" may have 

been created by a pirate in hi s owhvinterest. Therefore; ~ - , 
in thetoetse where a program purchase (Le:, a purchase: 1 V 
record) overwrites a preview record, the present inven- •' 
tion prpvicje^ yarious-deifer^es<.First a purctesewhich 
oveiwiies^a prev^rrecord involves ajeecure irarasferi of 
debit,, m which; the^ebit -totali sf'the.* usfer's decoderris >m 
increased toy^the- program cost.f>The . nurftt>ei> of. pur-. ■ •: 
chases mac^e j9~also panted in arsecure manner. tSec- . 
ond, ^e.purchase.recond" itself remaios iormemdry. until 
the purchased^event js .over. ^frus .manner, the record rc 
is not ^ av^abjefe^nother.arytime free previeaw until the 
termination ofethepuiohaseci event. * : >x? ■* 

l%acprpgj3miSelect«d1orspurchase.is ^ theipro^amr.. ... 
def in^pyjfli^previewrrecQcd. then 'that -record is simply = ^ 
c»nv^e#tQ^&purehasje f^cprd and the recocd; remains \.i 
open^ft#rrsa^re>fl^u3CQr4 tia&been act^atedrd* subric^ n 
sequ^^u^^se e^^ii^p^'are^llrbeii x • 

this m^J^iIpe^Ate^creep^Bf^^^ "i-^ 
erased.^A^furtt^ precaution, the secureprocessor:2p •* ; *u 
establishes ^rminim^mrexpiration ime foe apurchase. • 
record? ffei^ rn^ijrwttime can be,, for example, on the* * x 
order of one t^ur^arKij^ frustrate potential attacks by ± 
a pirate thiat attempts tot cause ^n early, expiration of a * 
purchase xeoordb ..v - .< : s ^ , r 

r. Tirning.pfTpRogram durations and anytime free pre- : 
view periods is majntained )by secure processor 20. A * 
real time program expiratien counter temaintainedvin the 
secure.prpcessQr far this purpose. Program durations 
and AFP pei;tpd3?can be giv« in unite of working key 
epochs, > • ,i i t . ... ... 

As indicated v aboye, a set of multifunction records is 
maintained; i n tfiesecure processor 20 to handle anytime - * : 
free pteyje^s.and.purQliased programs. A set of isl such • . - 
preview/program record.s is illustrated diagrammatically 
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in Figure 5. The records 90, 92, 94, 96 and' 98 each • . 
include program attributes (including access ' require- ~ 
ments) for the particular program or event that th&record^ 
pertains to. A preview record will also maintain ta count : . 
of the time remaining (e.g. , number of free workingkeys . 5 
remaining) within the maximum AFP deration for watch- 
ing a free preview. A purchase record is rendered ft rrev-: ± 
ocable when established after a free preview, e c 

The program attributes will bbrinprise information 
such as the; cost of the;program, which access'require- 10 
ments (e:g., '"tiers") a user must subscribe >to in-order to - ? 
receive the program, whether an AFP. is available for the " rf.' 
program and if so how. many free working keys are pro- 
vided for the AFP, arvjnitial free preview3bdundary:ifan ■ r 
initial free preview is available instead of or in addition to is 
an anytime .free preview, and various regional access 
information^ Since the access requirements are authea- c - 
ticated by one way fuhctiom48, as shown in' Figure 2," ' i 
none of these requirements can be alters wrthbutialte!* 
ing the program key that is used to generate -the worWng^ : 20 
keys fordecrypting the program; lithe program key used - " ; 
to decrypt differs from the one-used to encrypt; decryp- 
tion will fail. The inclusion of^he maximum AFP duration l - 
(i.e., number of free. iWKs permitted) as an access '> 
requiremem autherrticatesjthis parameter and f prevents' , 25 
its alteration without invahdatihglhe working keys: '. - 

Each previewy^urchase : record' also includes^^a : " 
record ivalidaf lag; a purchase flag, an expiration timer • ^ 
count and apportion >of the program; key Used as a^ro- x : 
gram idemrfier^¥herec6rd:valid flagman be, forexafnfcfle, so 
a one bit flagstbat indicates whetherthe record^ vateior 
not. This flag, when set-indicates- *hat the record- oori- 1 ^ 
tents are valid. When thef lag'is clear, the record is cur- v 
rently undefined. \* ■'"* o-^v inrv^t: ccrr'ijt j. "-■ 

The purchase; flag- indicates^ that the fectord~ is 
describes^ purchase record instead of a preview recdrd. > 
The working key epoch count is disr&&ardecf if the p£ir* '*o ■ 
chase flag is set : ^The expiration timer ^counts in 'pr«je- 
fined units (e.g., 2.56 seconds) -the time ' left the - 
program. Once the record is expiredtfhe record valid flag 40 
is cleared;-^ ig -u ^n. c:;*; h .&■=«» a 1/ w-,. c 

The portion rof^te prc^rarrwKey^^ided ftlfRe'pte?- 
view/purchase record cbmprise£7 erg?i*frv^byfe% bf 4he rv:i * 
clear-program key and is used as ^prc^ram idehtifier^ >z 
The working key epoch count GountsthettUmber bf wbrk- ; 45 
ing keys provided during the anytime free preview.^ & > 

As part of ithe derivation of afi^^horiizatibh state, "'■ -■ 
which is required to enable a user to view a prBgrafrt, the-" 
secure processor determines if a giv^ prograrttis vi^v- 
able via an anytime^free preview- H ah AFP-isf offered for "so 
a particular: programs but ail • of the ^available * pre- " 1 
view/purchase records are in use (Ss rrtdicSted by* their* •'*• 
record valid flags), a free preview cannot be granted.^ T: 

Although a preview record could be established 
each time a user tunes to a channel offering an AFP, such ss 
action is not preferred. The reason is that as a user sue- ^ 
cessively tunes to different channels (an activity known 
as "channel-surfing"), programs offering AFPs' win be • 
successively encountered and the N available records 



will be quickly used up. Thus, the user interface 26(Fig- 
ure 1 ) will offer the user the option to view ah AFP if avail- 
able, will offer the user the option to buya program being 
previewed, will provide the user with an indication of how- 
much free preview time is left for the program, and wiir : 
handle cases where initial free preview (an offering of % 
preview for a limited duration at the very beginning of a .' 
program) and anytime free preview offerings interact. In ' : 
a preferred embodiment, the user interface is provided : r 
via on screen displays on the user's television 28. The > 
generation of; such on screen displays is well known in : 
theart. • ■. * ;\ r - r ' ~ ■ . • ^v<?.q 

In general, an on screen display will be available vc - 
when the'secure processor determines that ah AFP is 
available for an acquired program. The user interface Will 1 ° J 
collect text messages defining the AFP option screen: If 
the user selects an AFP, the user interface reports this * J 
fact to the secure processor 20 and' free access rt is % * tr * 
granted for upto the maximum AFP duration. In &n alter- 
hate embodiment, an AFP can be autorratically granted * 
when a sufficient time has elapsed after ihS user tunfes : d 
to a particular r service. s ■ '-~:-V* 

In order to handle possible conflicts between an iiii- T ' ' * 
tial free preview and an anytime free preview, *rt is pref-" 1 * v ' 
erable that- several rules be enforced: First, if aprogram 1 5 
has been acquired 7 during an initial free preview period * : 
(or during a preceding 'epoch), the fact that ari AFP is 
offered shall be disregarded. If the user chooses hot to : - : * 
purchase the program and the user encounters the same ' 
progrlam at a later time after the initial free period is over : 
(i.e., after toning away from the program and then back' ; 
to the program) ?then an AFP rhay be offered. Secohcl, - 
a program purchased during the^AFP fjeriod may ne^er 
be cancelled. Once a pufchase is made r dUring : an AFP ' 
period; the purchase is immediate and irrevocable: ; j - : ■ 

Rgures 6 an'd'7 illustrate, infldwchart forrri, the prbb- ' f 
ess by which ainytinie free previews are* provided ih 0 ^ 
accordance with the preserrtinvehtibn. TfieVoutirVe'com- 5 
mences at boi 100, and at box 102"a working key et>6ch : 4 s 
message is acquired. The WKE message identifies the^ ^ : ^ 
WKE count wfthin the current' program epbch; At bbk 
104, a program rekey message is acquired; As indicated; i : j 
in conhectibn with the description of Figure Sr'W&'fSo-""" 1 - 34 
gram pre-key is required in order to generate 1 the pr<£ 1 % ' u 
grarn key ai^urtimately the working keys for authorized^ 
users. At box 106, the authorization state for the user is : \ 
commuted, in order to determine if the user is authorized " 
to receive the program and any AFP provided for the pro : ' : ' 
gram: If the > us'eTr isaiitfibrized to receive tHeprogram; a :ur 
determination is made at 3 box 108 as to whether or not ^ 
the usefr*has indicated a desire to purchase the ptogrark x 5 
If so, a purchase record is created af box 1 1 0: Upon cf & 3r * 
atiorf of the purchaser record, a ; truncated portion of Aie 
clear program key (output from one way functibh 48 of ' 
Figure 2) Is stored at box 1 12. The cleair program ke/js " 
usedbyonewayfunrtori52(Figure2)t6derrvetr^^^ * 
essary working ifeys as indicated at box 1 1 4. & r 

While the working keys are generated; a deterrrtina- 
tion is made at box 1 1 6 as to whether the program* epocK ' 
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has ended. If not, the derivation of working keys contin- ; 
ues and the process loops between boxes 1 1 4 and 116 
until the program epoch ends. Upon termination. of the ■.- 
program epoch, the. purchase record is deleted as indi- 
cated at box 1 1 8. The routine then ends at box 120. : , 5 

If . a program has. not yet been purchased by an 
authoriz ed user, the routine will proceed from box 1 08 to : 
box 1:22: where a determination is made as tcr whether " 
the program; epoch has 1 ended. If so, the routine ends at 
box 3£0. If the program epoch has not encted,-a>deter- 10 
mination.is made at box 1 24 as to whether an anytime 
free preview is available. If not, the routine loops back to •■ *» 
box .108, : c , ; ~~ <•» rr 

jf afvAFB is available for the program (as indicatedi ; 
for example, £>y ajiqrvzero : AF£ count qr by a separate ts 
"AFP avap^bler bit), a determination^ giad£.at : box 126 
as to ; whether, the user has requested tp watch 9 free * 
preview^ J*$> rputine loops back to ; bQx*l08. If en ^ 
AFP is -requested; the rputine passes to&ox 1 2§ <# Fig- . 
ure 'k i Mpox i ^2B, a-preview record is created Then, st 20 
box j^an AFP^xpir^tionaCpurner (AEG) is initialized.^ .4 
At box 132, the clear program key is stored together, with .-. z- 
the AFR count, The AFP count is decremented with ^ach 
worWngkey^and provides a repord of jthe remaining time 
in the m^xinpurn ^FP duration (1 e . amoucrt g| time 26 
that frerViwer has lefttto prevtew the t program *pr free). c ; 

At-laox, J£4 in a wofWngt key is created and the AFP- 
count is decrement^j. The program expiation tome is^ 
then .c^rr^u^. directty from the oin^^ working key 
epocj^as V^icatedat bpx 136. In thrs manner, the AFP 3P 
reco^^xpij^itipn is dynamically recalculated every work- 
ing key, r\rx particular, a variable,^ ts computed; where 
M = (^f P J^ndary- current WKE count) . ■ M is then !( 
converted Jo rea( time -using simple scaJmg, and if the - 
result is bigger th*n the AEQ as determined at box 1 38, 35 
the AEG i-jSv overwritten with. the computed expiration time 
at box 140 t Tbis wilMengthien the AEG to prevent a pirate ^. ? 
from ^jarrjpting to shorten the AEC in order to extinguish 8 
a preview, re^rd anctpbtsun arvaddrtjpna! AFPfpr the r 
prograra^^,..." _ . , ; ■": ; v : ^ .-fr *P 

^fteRthe £EGis,tested and ft ne^^ary.pyerwitt^n, 
a detf n^ijatjqri is $nade,at be% 144,; ^& ; to whethercthe v 
AFP.^naxjprjum ^rgtipn, h^s (expired . rf the. number , 
of fr^^rttir^ kpy§ for tbe preview,, has been^decse- , ; 
merrt^d tp^ero) 6 Jf d ^^y,further AFPJfor the-prograrrv -,.45 
is d^author^ed at box 152, Otherwise, a determination. * . * 
is mage atbpx 146 as to whether the AFP£pundar£hafr 
beerVjpassedL The AFP; boundary is the working key 
epoch cpunt representing the boundary beyond, which 
an anytime 3 fr;ee previewjs not allowed. As indicated so 
abov t e,ihis$$TOT by including it in , v 

the program key generators.^ - :i; - ; .= 

lithe, ^FP boundary has been passed, ^ny further 
AFP foe ; ttieprograrji is deauthorized at box 152. Other- ... 0 
wise, a deterrnination is made at box 1 48 ascto whether 55 
the AFP f]as been terminated by the user.. If not, the rou- 
tine waits for the next working key .epoch (box I49).and - 
then a new working.key is created at box 1 34. The routine 
then, continues until .either the AFP maximum duration 



has expired; the AFP boundary has been passed or the 
AFP is terminated, by the user. Upon termination of the 
AFP by^ttieeuser, the current AFP duration count is held 
as indicated at box 150 and nothing is done until the pro- 
gram js purchased, the program- epoch tends, or an AFP 
is agatn^equested:v:The AFP duration count will Enable 
the userito-ieinjtiate ah anytime free, preview during the 
program, and before the-AFP boundary, until the»maxK 
mum ^.^R^ratiOB has expijed. .^-..75 -n,-.v-- c i"' 

Upoo tiolding the^FP duration;eount afteD amAFP 
is tenni0atedt)y the user, or deauthorizmg the AFP after, 
the rmxImumsAFP. duration has; expired* oro the rAFP . 
boundary has been passeclj^heTOutine of Rigurte 6 and; 
7 returns tc^box d 08.. A user can then purchase the proz - 
gram tor, secvice unlessiheprogram -epoch has ended. & 

In an-arternate-embodimeot/thevirain^ 
AFP expfrationiCQunteff and computation of the exprrafon 
timefromthe WKE {boxes 130 and 136 tool 40 of Figure f 
7) cata bere*tminated Jay ,simply:setting ajminrmum pre* t 
vjewjiifecoai^expirationjtii^-FQrj.example,^ preview 
record :once.estab»tah,ed .can to maintained for a mini- : 
murrvQf jt»a hOHrs-rThis wilkse©ure theanytime free pre- 
viewifeature su'ch^at-ap^rate'x^-n6t♦Js4ea^rrri6re than 
one AflRevery-twQ hpurs., If ttie minimum preview record , 
expiratiprvtime isJongerthan tbelongest typical program 1 
epoch, then ^ither^s^m«thpd.,oitttie method illustrated 
in F©upa7..can be-useditapreveot the je^iration ot ah 
activerprevi©i«rabje^ service rrecord^untLfc the 'prdgram 
epoc&.foethe ser,vic^j-epreserrtedijy that recordasuOYerr 
- ftsiiQfcBdrnow be^pr^ai^trMtfeep^'&ent^nven- 5 
tion presides .a fraeprevrew feature foDS^rviicfiSjayailabie • 
for a fee over a o>mmunic^tioo«nelwDrk.nAp^ prd"r 
gram purchaser is provided withrthe abitity to vrew a lira- : 
ited number of minutes of a movie or other pBogram for 
^reei;«$ san «snticerrtentito; purchase the. secyice. Th§ 
pres^dnverrtion-i.mpi:ov.es upon prior art imptementav 
tions.twh^ onlythe.begihningiaortion of a movjje^ could • 
be Nflewed^withoutcbai^^With the. anytime freepreview .. 
featL^ePf^thepr^ent inyen|ion; previewiog is not limited: 
to th>^eginningjc?f ar^ersvaceu jhe;duratiomotthe freer 
preview is variable and may be defined on a program by 
prog^p J^sfe ^c9P*fiffywgfr»^ pr^gtartri .attribujevf a 
maxiiiHjLjfji ^ffbc^ati^aTr^inyeiton^aiso enables a . 
userto vi^^ fpqff^pn^i^avMlWe free preview at jwie -. 
^ me^,tu/^^w^ arad thw netyrn to watch: an additional 
portion ofvth^froepjeview: The u^ee.carrbreak the; free 
previ^fintGt^rrmnyippr*on§ as desired, as long a&the 
maximum^FPiduratiQn is not ; exceeded. or w »r- 

Arttjough thg invention has been described jn con- . 
nectipn wjth .^^cifrc embodiments thereofrthose sWILed ; 
in thwart wiltapprecfete that numerous adaptations and: 
modifications rnay, be ?made thereto without departing 
from the ^spir&and scope^of the invention as . set forth in-, 
the claims;: 3 ,;g , ^ - ; -.0-- - » r 

Claims n 

ir.v-*.fy{ !**■ .» ••. ^-J'* . : 'vr'. 

1 . .^methed for. provicting video services to consumers 
via an information networK comprising the steps of: 
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providing a video service on a pay-per-view 
basis during a program epoch; . r 't ~ - 

defining a fixed period during said program 
epoch when portions of said video service are avail- 
able for viewing on a preview basis; 

allowing a consumer to preview, without pur-, 
chase, portions of said video service at any time dur- 
ing said fixed period for up to a maximum preview 
duration that is shorter than said fixed per"tdd;;and 

enforcing said maximum preview duration ir\ 
a cryptographically secure manner. 
:Ji ~ ■' •: * - " ' £r a ' ■ r.-^2vv-\v< 

2. A method in accordance with claim T« comprising the 
further step of: c * ^ : \a. -i: u ; > 

, . enabl ihg> a consumer to purchase said Video 
service for viewing during saidprogram epoch after 
previewing portions thereof. 

3. A method in accordance with claim 1 or 2 wrr6r«rY 
said program epoch is divided irrto a plurality of 
working key epochs (WKE's), comprising the further 
steps of: 

cryptographically authenticating a count of 
said WKE's; and 

using the authenticated count to implement 
said maximum preview duration. 

4. A method in accordance with one of the preceding 
claims comprising the further step of: 

maintaining a record to indicate the amount 
of unused preview time remaining for said consumer 
to view said video service during said fixed period; 

wherein said record is maintained in a cryp- 
tographically secure manner. 

5. A method in accordance with one of the preceding 
claims comprising the further steps of: 

maintaining a record of services which said 
consumer has previewed during prior program 
epochs; and 

prohibiting said consumer from previewing a 
service during a current program epoch if the con- 
sumer has previewed any part of that service during 
a prior program epoch. 

6. A method in accordance with claim 5 wherein said 
record of services is maintained in a cryptographi- 
cally secure manner. 

7. A method in accordance with one of the preceding 
claims comprising the further steps of: 

maintaining up to N active records of preview- 
able services at a time, each record comprising 
either a purchase record representing a previewable 
service that has been purchased by said consumer 
or a preview record representing a service that said 
consumer has selected for preview; and 

preventing the expiration of an active pre- 
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viewable service record until the program epoch for 
the service represented by that record is bver. 

8. A method in accordance with claim 7 comprising the 
5 further step of: 

. preventing the erasure of any preview record 
until the program epoch for the service represented 
thereby is over. '■ : ' ^ ' 7 

to 9. A method in accordance with claim 7 comprising the 
further-steps of : v ■t.tv..^ 

t " converting a preview record 'tor'a purchase 

record upon purchase by the consumer of the serv- 
ice represented by the preview record; and r ' 

is rendering the purchase record resulting from 

said converting step irrevocable; ' * 

— 10. A method in accordance with claim 9 corrprisin^ the 
further step of : ; V: ~ ' 

20 ■ - ' preventing the erasure of any preview record 

until the program epoch for the service represented 
thereby is over, except by conversion to an irrevoca- 
ble purchase record. 1 f !: \ - ? 

25 ii. AVnethod in aiccordance with one of claims 7 to 10 
comprising the further step of: ^ 
; ' denying any additional previews to said con- 
sumer whenever all N previewable service records 
are active. 3 - 

30 • ' ; 

12. A method in accordance with one of the preceding 
claims comprising the further step off : ' ' ~ 

informing said consumer of how rrufch 
unused preview time remains for said video Service. 

13. A method in accordance "with one of the preceding 
claims wherein said fixed period is enforced in a 
cryptographically secure manner. 

40 14. Apparatus for providing previews of services availa- 
ble for purchase via a communication network, bbhrif 
prising: - * "* f - : ■ : ; p ' ;r> '- : 

- first meansfor processing data r^eivedfrpm 
said communication network, said data (ij fdehtifyirig 

45 a service available for purchase, (ii) identifying an 
epbch over which said service is provided, (iiif indi- 
cating whether a preview is available for said serv- 
ice, and (ivj providing infbrmatior/i necessary to 
generate keys for enabling an airthbrized consumer 

so to receive said service or a preview thereof ; 

second means responsive to said first means 
when a preview is available for said service for keep- 
ing track of a fixed period during said epoch wrieri 
previewing is permitted; ~ 

55 a user* interface cooperating i with said first 

and second means for enabling a consumer to pre: 
view portions of said service at any time during said 
fixed period for up to a maximum preview duration 
that is shorter than said fixed period, said user inter- 
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face, also enabling a consumer to -purchase said 
service; and.. 

means responsive to said first means for 
decrypting said service during a preview and after a 
'purchase thereof. 

15. apparatus in accordancewith daim 14 further com- 
prising means for enforcing said maximum preview 
duration in a cryptographicaliy secure manner. 

16- Apparatus in accordance with one of clama : 14 or 
: 15,furttiercornprisii3g: ,. - ?..., r Y 

, , Xi . means for maintaining a record in a crypto- 
graphicaliy secure manner to indicate tti&amountof 
unusedpreyiew time remaining for said consumer 75 
to view said service, during .said fixed period. 

1 7. Appals in accordance with one of claims 14 to 1 6 
further comprising: / £ . 

.... ,. . means for maintaining up tp N records of so 
acjtivepreviewable services at a time, each record 
comprising either a purchase record representing, a 
previewable service that has been purchased by 
said consumer or a preview record representing a 
service that said consumer has sel ected for preyi ew< ?s 
and ' t s.\ .. . . 

. . . , means for; preventing* the expiration of an 
active previewable .service record urr^l Jheprogr£m 
epoch for trie service represented by that record is 
over. 30 

1 8. Apparatus in accordance with .claim if ^rther com- 
prising^ : .\ ; ' J. ■; v, : V r 

, , ; means foe. preventing, the erasur^of -any pre- 
view record until' the program epoch for the service 35 
repxeser^edttierebyJswer. c . t • 

1 9. Apparatus in accordance with c(aym r 1 7 further com- 
prising: 

, r . . „ means, for converting a preview record Jo-a 40 
pucc^^e;ec6rd upoa p^rchase by the consumer of 
the service represented by the preview record; and 

mor; td$8S& SS^SffSffW*' PWCtese record pro- 
yt$ e^'^v.saKj q^erting means irreycxaW . 

20. ^pkratusjn accordance with claim 1 9 further com- 
prising: ' \ t t ." t ; ... 

. . means for preyentingthe erasure of any pre- 
yieW record until the program epoch for the service 
represented thereby is over, except by conversion to so 
an i rr e^qcable purchase record . ~ . 

21 . Ap^rafus in accordance with one of claims 1 7to 20 
further comprising: - . t 

. . means. for denying any additional previews or ss 
previewable services to said consumer .whenever all 
N previewable service records are active. - „ 



22. Apparatus in accordance with one of claims 1 4 to 21 
wherein said user interface comprises: 

•r:c means for informing said consumer of how 
rrrucb unused preview time Terrains for said service. 

23. Apparatus in accordance with-cne of claims 1 4 to 22 
whererhsaid epoch is divided intd a plurality of work- 
ing key epochs; a cryptographicaliy authenticated 
count ofcwhich is used to implement said maximum 
prevkiwJduration. . ^ c» ; r 

24. Apparatus in accordance with one of claims 1 4 to 23 
fufthefrcomprteing'. <? - ij r„v ^ or ; 1 . . • rt,* ~jh A 

means for cryptographicaliy authenticating at 
i least the pQrttan;Ot said-data that identifies whether 
a.pr^ew^ is available for §aid service. „ -oiv, 

25. Apparatus in accordance with one of claims 1 4 to 24 
wfceriern said fixext period is enforced in a crypto- 
gr.ap£iipalty secure planner. : ; j : -q© k b» ><5 



■!C<'5n : h:.r iiif ^?it'3iiq noo £ 
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